Using similar Unicode characters to bypass authentication

GitHub turned out to be susceptible to an attack that allows access to an account through manipulation with Unicode characters in the email. The issue is related to the fact that some Unicode characters, when applying case conversion functions, are transliterated to standard characters that look similar (when multiple different characters are transliterated to one character — for example, the Turkish characters ‘ı’ and ‘i’ are converted to ‘I’ when capitalized).

Before checking the login parameters in some services and applications, the data provided by the user is initially converted to uppercase or lowercase and then checked against the database. If the service allows the use of Unicode characters in the login or email, then an attacker can use similar Unicode characters to carry out an attack that manipulates collisions in the character case conversion tables (Unicode Case Mapping Collisions).

‘ß’.toUpperCase() == ‘ss’.toUpperCase() // 0x0131
‘K’.toLowerCase() == ‘K’.toLowerCase() // 0x212A
‘John@Gıthub.com’.toUpperCase() == ‘John@Github.com’.toUpperCase()

On GitHub, the attacker could initiate the sending of a recovery code to another email through the password recovery form by specifying an address in the form that includes a Unicode character causing a collision (for example, instead of mike@example.org, the email mıke@example.org was provided). The address passed validation because it was converted to uppercase and matched the original address (mike@example.org), but during the email sending, it was inserted as is, and the recovery code was sent to the fraudulent address (mıke@example.org).

Some of the characters, causing collisions during case conversion:

ß 0x00DF SS
ı 0x0131 I
ſ 0x017F S
ff 0xFB00 FF
fi 0xFB01 FI
fl 0xFB02 FL
ffi 0xFB03 FFI
ffl 0xFB04 FFL
ſt 0xFB05 ST
st 0xFB06 ST
K 0x212A k

Source: opennet.ru